Dnsmasq TFTP Service Remote Heap Buffer Overflow Vulnerability

Bugtraq ID:	36121
Class:	Boundary Condition Error
CVE:	CVE-2009-2957
Remote:	Yes
Local:	No
Published:	Aug 31 2009 12:00AM
Updated:	Oct 16 2009 01:38AM
Credit:	Pablo Jorge and Alberto Soliño
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 SuSE SUSE Linux Enterprise 11 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 Red Hat Fedora 11 Red Hat Fedora 10 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Pardus Linux 2009 0 Gentoo Linux Dnsmasq Dnsmasq 2.49 Dnsmasq Dnsmasq 2.48 Dnsmasq Dnsmasq 2.47 Dnsmasq Dnsmasq 2.46 Dnsmasq Dnsmasq 2.45 Dnsmasq Dnsmasq 2.44 Dnsmasq Dnsmasq 2.43 Dnsmasq Dnsmasq 2.42 Dnsmasq Dnsmasq 2.41 Dnsmasq Dnsmasq 2.40 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	Dnsmasq Dnsmasq 2.50

Dnsmasq TFTP Service Remote Heap Buffer Overflow Vulnerability

Dnsmasq is prone to a remotely exploitable heap-overflow vulnerability because the software fails to properly bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.

Remote attackers can exploit this issue to execute arbitrary machine code in the context of the vulnerable software on the targeted user's computer.

Versions *prior to* Dnsmasq 2.50 are vulnerable.

Dnsmasq TFTP Service Remote Heap Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Dnsmasq TFTP Service Remote Heap Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 ia-64

• Debian dnsmasq-base_2.45-1+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_ia64.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu dnsmasq-base_2.41-2ubuntu2.2_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2 .2_powerpc.deb


• Ubuntu dnsmasq_2.41-2ubuntu2.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41 -2ubuntu2.2_all.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu dnsmasq-base_2.45-1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1 .1_powerpc.deb


• Ubuntu dnsmasq_2.45-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45 -1ubuntu1.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu dnsmasq-base_2.41-2ubuntu2.2_sparc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2 .2_sparc.deb


• Ubuntu dnsmasq_2.41-2ubuntu2.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41 -2ubuntu2.2_all.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu dnsmasq-base_2.45-1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 5-1ubuntu1.1_i386.deb


• Ubuntu dnsmasq_2.45-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45 -1ubuntu1.1_all.deb

Debian Linux 5.0 alpha

• Debian dnsmasq-base_2.45-1+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_alpha.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Debian Linux 5.0 ia-32

• Debian dnsmasq-base_2.45-1+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_i386.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu dnsmasq-base_2.41-2ubuntu2.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 1-2ubuntu2.2_amd64.deb


• Ubuntu dnsmasq_2.41-2ubuntu2.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41 -2ubuntu2.2_all.deb

Debian Linux 5.0 s/390

• Debian dnsmasq-base_2.45-1+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_s390.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Debian Linux 5.0 mipsel

• Debian dnsmasq-base_2.45-1+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_mipsel.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu dnsmasq-base_2.47-3ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0 .1_sparc.deb


• Ubuntu dnsmasq_2.47-3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47 -3ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu dnsmasq-base_2.47-3ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0 .1_powerpc.deb


• Ubuntu dnsmasq_2.47-3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47 -3ubuntu0.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu dnsmasq-base_2.41-2ubuntu2.2_lpia.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.41-2ubuntu2 .2_lpia.deb


• Ubuntu dnsmasq_2.41-2ubuntu2.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41 -2ubuntu2.2_all.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu dnsmasq-base_2.45-1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1 .1_lpia.deb


• Ubuntu dnsmasq_2.45-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45 -1ubuntu1.1_all.deb

Debian Linux 5.0 hppa

• Debian dnsmasq-base_2.45-1+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_hppa.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu dnsmasq-base_2.47-3ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 7-3ubuntu0.1_i386.deb


• Ubuntu dnsmasq_2.47-3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47 -3ubuntu0.1_all.deb

Debian Linux 5.0 m68k

• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu dnsmasq-base_2.45-1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.45-1ubuntu1 .1_sparc.deb


• Ubuntu dnsmasq_2.45-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45 -1ubuntu1.1_all.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu dnsmasq-base_2.47-3ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/d/dnsmasq/dnsmasq-base_2.47-3ubuntu0 .1_lpia.deb


• Ubuntu dnsmasq_2.47-3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47 -3ubuntu0.1_all.deb

Debian Linux 5.0 arm

• Debian dnsmasq-base_2.45-1+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_arm.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Debian Linux 5.0 armel

• Debian dnsmasq-base_2.45-1+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_armel.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Debian Linux 5.0

• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu dnsmasq-base_2.41-2ubuntu2.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 1-2ubuntu2.2_i386.deb


• Ubuntu dnsmasq_2.41-2ubuntu2.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.41 -2ubuntu2.2_all.deb

Debian Linux 5.0 amd64

• Debian dnsmasq-base_2.45-1+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_amd64.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Debian Linux 5.0 mips

• Debian dnsmasq-base_2.45-1+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_mips.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu dnsmasq-base_2.47-3ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 7-3ubuntu0.1_amd64.deb


• Ubuntu dnsmasq_2.47-3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.47 -3ubuntu0.1_all.deb

Debian Linux 5.0 powerpc

• Debian dnsmasq-base_2.45-1+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_powerpc.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu dnsmasq-base_2.45-1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/d/dnsmasq/dnsmasq-base_2.4 5-1ubuntu1.1_amd64.deb


• Ubuntu dnsmasq_2.45-1ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/d/dnsmasq/dnsmasq_2.45 -1ubuntu1.1_all.deb

Debian Linux 5.0 sparc

• Debian dnsmasq-base_2.45-1+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq-base_2. 45-1+lenny1_sparc.deb


• Debian dnsmasq_2.45-1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/d/dnsmasq/dnsmasq_2.45-1+ lenny1_all.deb

Dnsmasq TFTP Service Remote Heap Buffer Overflow Vulnerability

References:

• Dnsmasq Home Page (Dnsmasq)
  
• Dnsmasq Heap Overflow and Null-pointer Dereference on TFTP Server (Core Security Technologies)